Insteon's vulnerability footprint, despite a narrow product portfolio, centers on a prominently deployed home-automation hub platform that serves as a control point for smart-home environments. Vulnerabilities affecting the vendor skew strongly toward critical severity and recur persistently across hub firmware and hardware variants through memory-safety weaknesses—stack-based and classic buffer overflows, out-of-bounds writes, and related buffer-boundary violations—alongside authentication-bypass flaws that reflect the embedded nature and network-facing role of the platform. The concentration of memory-corruption defects in a networked device with limited update penetration creates a durable, high-risk exposure profile that can persist across many deployed instances. Defenders should prioritize inventory and isolation of Insteon hubs and treat firmware updates as security-critical rather than discretionary; current exploitation activity and severity breakdowns are shown alongside this summary.
The number and severity of CVEs published that impact products developed by Insteon over time
Signals from CVEs in this vendor scope (114 CVEs).
114 CVEs · Highest risk first
| CVE | Published | CVSS | Risk | KEV | Exploit |
|---|---|---|---|---|---|
CVE-2017-16334CRITICAL Multiple exploitable buffer overflow vulnerabilities exist in the PubNub message handler for the "cc" channel of Insteon Hub running firmware version 1012. Specially crafted comman | Jan 11, 2023 | 9.9 | 32 | NO | NO |
CVE-2013-4859HIGH INSTEON Hub 2242-222 lacks Web and API authentication | Dec 27, 2019 | 8.1 | 32 | NO | YES |
CVE-2017-16347CRITICAL An attacker could send an authenticated HTTP request to trigger this vulnerability in Insteon Hub running firmware version 1012. At 0x9d01e7d4 the value for the s_vol key is copied | Aug 2, 2018 | 9.9 | 32 | NO | NO |
CVE-2017-16346CRITICAL An attacker could send an authenticated HTTP request to trigger this vulnerability in Insteon Hub running firmware version 1012. At 0x9d01c368 the value for the s_mac key is copied | Aug 2, 2018 | 9.9 | 32 | NO | NO |
CVE-2017-16331CRITICAL Multiple exploitable buffer overflow vulnerabilities exist in the PubNub message handler for the "cc" channel of Insteon Hub running firmware version 1012. Specially crafted comman | Jan 11, 2023 | 9.9 | 31 | NO | NO |
CVE-2017-16330CRITICAL Multiple exploitable buffer overflow vulnerabilities exist in the PubNub message handler for the "cc" channel of Insteon Hub running firmware version 1012. Specially crafted comman | Jan 11, 2023 | 9.9 | 31 | NO | NO |
CVE-2017-16329CRITICAL Multiple exploitable buffer overflow vulnerabilities exist in the PubNub message handler for the "cc" channel of Insteon Hub running firmware version 1012. Specially crafted comman | Jan 11, 2023 | 9.9 | 31 | NO | NO |
CVE-2017-16328CRITICAL Multiple exploitable buffer overflow vulnerabilities exist in the PubNub message handler for the "cc" channel of Insteon Hub running firmware version 1012. Specially crafted comman | Jan 11, 2023 | 9.9 | 31 | NO | NO |
CVE-2017-16327CRITICAL Multiple exploitable buffer overflow vulnerabilities exist in the PubNub message handler for the "cc" channel of Insteon Hub running firmware version 1012. Specially crafted comman | Jan 11, 2023 | 9.9 | 31 | NO | NO |
CVE-2017-16325CRITICAL Multiple exploitable buffer overflow vulnerabilities exist in the PubNub message handler for the "cc" channel of Insteon Hub running firmware version 1012. Specially crafted comman | Jan 11, 2023 | 9.9 | 31 | NO | NO |
Signals from CVEs in this vendor scope (114 CVEs).
An overview of all social media posts that mention a CVE ID that affects a product developed by Insteon.
Media articles that mention a CVE ID that affects a product developed by Insteon — matched by CVE ID, not by vendor name.